>>>>> "Neil" == Neil Williams <[email protected]> writes:

> Error handling is the main reason. Unpacking might fail, the archives
> might be the only source of data.

> Could you have a look at the current SVN revision and let me know how
> that matches your tests?

I'm going to have a look at it and test this stuff on friday.  

>> That's exactly the problem: inconsistent versions in the archive or
>> archive updates while multistrap runs.

> That sounds like a broken archive.

> I haven't implemented the versioned source call - I remain unconvinced
> that a valid archive would cause the download of a source package of a
> different version to the binary package.

Are you assuming a non-changing archive?  As soon as the archive changes
non-atomically (with locking applied by the client) I think we're
doomed.  As we're building images from debian sid, changes will be
pretty common.

I'm not sure how many times 'multistrap' performs 'apt-get update'.
Even if it only does it once, the source and binary package indices are
distinct files, and they are retrieved by distinct transaction from the
ftp/http server, so I see no way that you can guarantee consistency
during mirror pushes.

The only atomicity you have is for updating a single index file via
'mv'.

The following scenario: 

 * mirror gets updated, probably first new files put into the pool, then
   the new indices follow, then even later, it's going to delete the
   files no longer referenced by the indices.

 * Concurrently I run 'multistrap' which runs 'apt-get update', fetching
   dists/sid/main/binary-amd64/Packages.bz2 and
   sid/main/source/Sources.bz2 .
 
 * Now I get Packages.bz2 from before the mirror update, and Sources.bz2
   from after the mirror update.  Sources.bz2 is going to have some
   packages updated to newer versions, and won't correspond 100% to
   binaries from Packages.bz2, thus violating the GPL

Of course I guess the error rate will not be too high, at least not
over a normal high-rate internet connection.  

cheers,

David
-- 
GnuPG public key: http://dvdkhlng.users.sourceforge.net/dk.gpg
Fingerprint: B17A DC95 D293 657B 4205  D016 7DEF 5323 C174 7D40

Attachment: pgpjbDIxwAMg7.pgp
Description: PGP signature

Reply via email to